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Introduction 

On April 18, 2019 the office of the Federal Defenders of New York requested ESi review file 
materials relevant to a series of incidents involving the mailing of artifacts identified as “weapons 
of mass destruction—namely, a destructive device as defined by Title 18, United States Code, 
Section 921”. Specifically, ESi was requested to review the file contents and opine on the nature 
of the devices and the results of analyses conducted on the contents of the mailed artifacts. 

Basis for this Report 

This report, and the opinions and conclusions stated throughout, are based on the education, 
training, and experience of the author, as well as on the analysis and review of materials that 
have been completed in this matter to date. The opinions and conclusions are provided to a more 
probable than not basis. 

Methodology and Analysis Activities 

During the course of investigation and analysis in this matter, to date, ESi has reviewed the 
following materials related to this matter: 

• The Southern District of New York Indictment for 1:18-cr-00820-JSR, filed 11/09/2018. 

• The Southern District of New York Complaint for USA v Cesar Altieri Sayoc, dated 
10/26/2018. 

• The Southern District of New York Discovery Materials Restrictions for 10 cr.820 (JSR), 
dated 4/15/18. (sic 4/15/19) 

• FBI Crisis Intake report, author redacted, dated 10/26/2018. 

• Photographs documenting the artifacts of interest at 16 separate field locations. 

• Photographs detailing the search of Sayoc’s van, FL license G4BLR. 

• FBI Laboratory report authored by SSA Kevin D. Finnerty, Explosives Unit, dated January 
2, 2019. 

• Laboratory notes, photographs and analytical results of the examinations performed by 
Kevin D. Finnerty. 

• FBI Laboratory report authored by Christine M. Marsh, Scientific Analysis Unit, dated 
November 7, 2018. 

• Laboratory notes, photographs and analytical results of the examinations performed by 
Christine M. Marsh. 

• FBI Laboratory report authored by Joseph C. Stephens, M.S.F.S, Chemistry Unit, 
Scientific Analysis Unit, dated November 27, 2018. 

• Laboratory notes, photographs and analytical results of the examinations performed by 
Joseph C. Stephens. 

• Curriculum Vitaes for Kevin D. Finnery, Christine M. Marsh and Joseph C. Stephens. 
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• FBI Laboratory quality assurance and standard operating procedures manuals. 

During the course of investigation and analysis in this matter, to date, ESi has completed the 
following tasks: 


• Reviewed the above file materials. 

• Completed this interim report. 

Qualifications and Experience 

Dale Mann, the author of this report, earned a BS in Chemistry from the University of Washington 
in 1978. He was employed by the Washington State Patrol Crime Laboratory from 1981-1998 
where he was a chemist, developing a specialty in fire and explosives evidence evaluation. In 
1998, he joined MDE and started the laboratory division of that company. MDE merged with ESi 
in 2016 and the laboratory became the primary location for chemical evaluation for ESi. Mr. Mann 
has over 38 years’ experience in the analysis and characterization of materials commonly used 
in improvised explosive devices, blasting products, fireworks and chemically incompatible 
materials. 

Background 

Sixteen (16) separate packages mailed to prominent individuals and politicians were intercepted 
in transit via the United States Postal Service over the course of a few days in late October 2018. 
The packages were visually similar, and each contained similar contents. The contents of the 
packages were deemed suspicious and initially identified as possible explosive devices or toxins. 
The person responsible for the assembly and mailing of the artifacts was identified and arrested. 
The defendant, Cesar Sayoc was arrested on October 26, 2018 and charged with numerous 
crimes related to the events. 

Review of Field Notes/Documentation 

Sixteen separate incidents occurred in which a package was intercepted in the US mail system. 
The recovered packages were of similar content. Each consisted of an outer padded mailing 
envelope that contained a smaller manila envelope with powder and a PVC pipe with end caps. 
There was a powder inside the pipe and a clock attached to the exterior of the pipe with wiring 
which extended from inside the pipe and led to the battery-operated clock chassis described as 
a possible destructive device or pipe bomb. The materials were photographed, x-rayed and 
rendered safe by local authorities and transferred to the FBI Laboratory for characterization and 
identification. 

The incidents and recovered artifacts were documented as follows: 

DATE INCIDENT LOCATION RECIPIENT FIELD ACTION 

10/22/18 1 Bedford, NY George Soros rendered safe 


Page 3 of 10 






Case l:18-cr-00820-JSR Document 36 Filed 07/16/19 Page 5 of 11 



USA V Sayoc 
ESi Project No: 70026P 


10/24/18 

2 

Chappaqua, NY 

Hilary Clinton 

collected intact 

10/24/18 

3 

Manhattan, NY 

John Brennan 

collected intact 

10/24/18 

4 

Washington DC 

Barrack Obama 

collected intact 

10/24/18 

5 

Capital Hts, MD 

Maxine Waters 

collected intact 

10/24/18 

6 

Los Angeles, CA 

Maxine Waters 

rendered safe 

10/25/18 

7 

Sunrise, FL 

Eric Holder 

rendered safe 

10/25/18 

8 

New Castle, DE 

Joseph Biden 

rendered safe 

10/25/18 

9 

New Castle, DE 

Joseph Biden 

collected intact 

10/25/18 

10 

Manhattan, NY 

Robert De Niro 

collected intact 

10/26/18 

11 

Opa Locka, FL 

Corey Booker 

rendered safe 

10/26/18 

12 

New York, NY 

James Clapper 

collected intact 

10/26/18 

13 

Sacramento, CA 

Kamala Harris 

rendered safe 

10/26/18 

14 

Burlingame, CA 

Tom Steyer 

rendered safe 

10/29/18 

15 

Atlanta, GA 

CNN 

rendered safe 

10/30/18 

16 

Burlingame, CA 

Tom Steyer 

rendered safe 


A sample of the powder in the small envelope in incident 3 was evaluated by the Westchester 
County Department of Laboratories and Research Microbiological Services for various biological 
threat agents including Bacillus Anthracis (anthrax), Brucella species (coccobacillus bacteria), 
Burkholderia species (Proteobacteria), Francisella Tularensis (coccobacillus bacteria), Yesinia 
pestis (coccobacillus bacteria), and Ricin toxin. None were identified in the submission. None of 
the other small envelope powders were analyzed for the presence of microbiological agents. 


The PVC devices in incidents 7 and 11 were rendered safe with an “energetic tool” or “high order 
detonation”. The powder contained in the devices did not react, spark or burn as a result of the 
render safe process. The device in incident 13 was cut open. Render safe details for the other 
devices were not provided. 


A sample of the bulk powder from the PVC device in incident 13 was field tested using a laser 
and a “burn test”. The sample did not ignite with the laser. The powder sparked but did not ignite 
in the burn test. The agents conducting this testing concluded the material was not energetic. 
There are no indications the other PVC device powders were field tested. 


Review of FBI Laboratory Examinations 

The recovered artifacts from the sixteen incidents and materials recovered from Sayoc’s van were 
submitted to the FBI Laboratory for evaluation. The examinations were conducted as follows: 


• Kevin D. Finnerty. Photographic documentation and descriptions of artifacts. 

• Joseph C. Stephens: Analysis of the powders in the small envelopes. 

• Christine M. Marsh: Analysis of PVC pipe powders and artifacts recovered from Sayoc’s 
van. 
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Finnerty Report 

The PVC devices documented in the Finnerty report have the follovying characteristics: 

• CPC pipe sections were 1” outer diameter and approximately 5.75” long. 

• End caps were not glued to the pipe sections. 

• End caps were simply slid onto the ends of the pipe sections. 

• End caps had a single hole through which an insulated wire was inserted. 

• A sealing compound was present on the exterior of the end caps to seal the caps and fix 
the insulated wires in place. 

• The wires led to a plastic battery-operated clock taped to the exterior of the PVC pipe. 

• None of the wires were connected to the battery circuit. 

• Some of the wires were loose and not connected/inserted into the chassis of the clock. 

• The functionality of the clocks was not determined, each had a factory printed sticker 
attached to the clock face. 

• The clock batteries carried between approximately 1 to 1.5 volts. (The batteries were rated 
at 1.5V, 35mAh.) 

• The wire leads were connected by a section of spiraled solder wire inside the PVC pipe. 
This coil was representative of a “bridge wire", used to generate heat when energized to 
initiate the combustion of a low explosive. Finnerty determined the solder was “not an 
efficient material to be utilized in this manner". 

• The pipes contained varying quantities of a grey powder, spherical particles, glass 
fragments and other materials. 

• The statement “Benign powders have been added to lEDs to simulate chemical or 
biological enhancement” is included in the descriptions of these devices. 

• Each device was described as non-functional due to its design. Included in each device 
description was the statement “The fuzing system lacked the proper components and 
assembly to enable it to function as a method of initiation for this device. It cannot be 
determined if the non-functional fuzing system is a result of poor design or the intent of 
the builder.” (Page 28 of 107 of the Finnerty Report contains this disclaimer for device #1.) 


Marsh Report 

The powders from the PVC devices were documented in the Marsh report. The contents of several 
devices were weighed. Some of these had been described as “rendered safe” in the field reports 
but were photographed in the FBI laboratory with the end caps attached to the pipe sections. The 
contents of devices which fragmented during the render safe process were not weighed. Weights 
were as follows; 

• Incident 1, pipe fragmented during render safe process, no weight 

• Incident 2, device recovered intact, 56.6 grams 
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• Incident 3, device recovered intact, 52.1 grams 

• Incident 4, device recovered intact, 41.6 grams 

• Incident 5, device recovered intact, 59.2 grams 

• Incident 6, device fractured during render safe process, no weight 

• Incident 7, device fractured during render safe process, no weight 

• Incident 8, rendered safe, 49.4 grams 

• Incident 9, device intact, 49.4 grams 

• Incident 10, device intact, powders mixed, no weight 

• Incident 11, device fractured during render safe process, no weight 

• Incident 12, device intact, 38.7 grams 

• Incident 13, rendered safe, no weight 

• Incident 14, device fractured during render safe process, no weight 

• Incident 15, device fractured during render safe process, no weight 

• Incident 16, device fractured during render safe process, no weight 

Explosive chemical mixtures, used in devices such as those intercepted in this case, require a 
minimum of two active components, an oxidizer, which supplies oxygen for the reaction, and fuel. 
The ratios of oxidizer to fuel control the reaction rate and therefore the efficacy of the device. 
Improper ratios, or excess inert components will drastically affect the reactivity of the mixture. No 
analysis to quantify the relative amounts of oxidizer, fuel and inert materials in the recovered 
powders was made by the FBI. Such determinations are relevant in the determination of the 
efficacy of each device. 

The analyzed powders varied among the devices. Morphologically, the contents in each device 
included grey powder, spheres up to approximately 5mm in diameter, and larger assorted 
particulate. The contents were not homogeneous or uniform. The oxidizers barium nitrate, 
potassium nitrate and potassium perchlorate were identified in each device. Fuels included 
charcoal, sulfur, and magnalium. Other/inert components included carbonates, oxides, sulfates, 
urea, chlorides, phosphates, cyanuric acids, minerals/clays and glass. 

Selected spheres or portions of the grey powder were tested individually for energetic ignition with 
the application of a butane flame source. The ignition test results varied; some particles sparked 
while others were non-reactive, it was unclear if intact composite samples, representative of each 
device contents, were thermally tested. 

Stephens Report 

The powders in the small manila envelopes labeled “mixed” were documented in the Stephens 
report. The enclosed powders generally weighed approximately 1 gram and were visually a light 
grey color. The powders were uniformly determined to be non-energetic. The primary composition 



Page 6 of 10 





Case l:18-cr-00820-JSR Document 36 Filed 07/16/19 Page 8 of 11 



USA V Sayoc 

ESi Project No: 70026P 


was determined to be calcium carbonate (gypsum) and fine gray fibrous fragments. A mix of 
aliphatic hydrocarbons was also identified in each. 


Discussion 


A pipe bomb has the following basic components: 


• An intact container which encloses the reactive mixture. This container should be gas tight 
to provide maximum efficiency of the device. If a pipe is used, the end caps should be 
firmly attached. 

• A reactant mixture. Mixtures can vary widely and produce a variety of energies depending 
on their formulation. 

• An initiating mechanism. This can be as simple as a burning fuse or may consist of an 
electrical discharge powered by a battery. 

• The electrical discharge can be simply controlled by a timing device, such a clock. 

The subject devices were assembled similar to each other. The design was such that none were 
functional as an explosive/destructive device. The following are descriptions of the deficiencies of 
the design and construction. 

• The container for the devices consisted of a short section of PVC pipe with end caps 
slipped onto each end. The caps were not glued or otherwise adhered to the pipe, 
producing a container which might vent by dislodging a cap prior to fragmentation of the 
pipe itself. 

• None of the devices contained an initiating mechanism. A coil of solder wire was used to 
simulate a bridge wire. The coiled solder wire cannot heat to the point that it will become 
incandescent and provide sufficient energy to ignite combustible materials. 

• There was no electrical circuit to energize the ignition mechanism. The wires were for 
aesthetic purposes only; they were not connected to the battery in the clock. 

• It was undetermined if the attached clocks had internal circuitry sufficient to be used in an 
initiation train. The provided files did not contain sufficient detail to make this 
determination. 

• The powder contained in each device was variable and was not confirmed to be thermally 
energetic. The single field test conducted yielded negative results. 

The burning of the oxidizer/fuel combination in a low order explosive mixture produces a gaseous 
reaction by-product. If confined, the resultant pressure can rapidly overcome the strength of the 
container, yielding a shock wave, audible report and expulsion of container/content fragments. If 
not confined, or in an inadequate container, the result will more likely be a bright flame and venting 
of gases with no audible report or shockwave. The "explosive potential” of a low order powder is 
therefore dependent on the velocity of the flame propagation though the mixture. The destructive 
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potential is due to the combination of the powder characteristics and design of the 
confinement/container. 

Low order explosive blends are commonly used in devices such as pipe bombs and fireworks. 
The active components of these blends are a combination of an oxidizer and fuel. The chemistry 
of the oxidizer and fuel, composition ratio, particle size, homogeneity and presence of other 
materials all affect the burn rate of the mixture. An inhomogeneous mixture of large grain size 
with the presence of inert materials, such as that documented in the powders from the recovered 
devices, ail decrease or eliminate the efficacy of the mixture. 

The powder cornpositions in the sixteen devices were not consistent, inconsistent compositions 
can result in inconsistent and variable flame velocities through the mixtures leading to 
unpredictable results. Therefore, verification of the efficacy of each device requires that, at a 
minimum, a representative portion of the powder from each be tested. It is not possible to 
extrapolate the reaction of a single particle isolated from a inhomogeneous mixture to the entire 
mixture. There is no assurance that the reaction of an individual particle isolated from the mixture 
to a flame would result in a flame velocity through the entire mixture sufficient to cause detonation 
of the device. 

The testing of device 13 demonstrates the above principles. A random sample of the powder from 
device 13 was energetically tested in the field. Later individual particles were isolated, analyzed 
and energetically tested at the FBI Laboratory. This was the only mixture energetically tested both 
in the field and laboratory. The field test, using an open flame, yielded sparking but no flame 
progression through the mixture. The contents of the PVC pipe were considered to be “non- 
energetic". Testing of individual particles in the laboratory, again using an open flame, 
demonstrated some of the components were thermally reactive and considered to be “energetic” 
while other particles were not. The presence of some reactive species in a mixture does not 
demonstrate that the mixture as a whole is reactive. 

Twenty-two (22) individual particles were tested from device 13 in the FBI laboratory. The basis 
for the selection of these particles was not described in the report. Analysis identified barium 
nitrate, potassium nitrate and potassium perchlorate as oxidizers, sulfur and magnalium as fuels 
and copper oxide, strontium carbonate, cyanuric acids, potassium magnesium sulfate and urea 
as other/inert components. Fourteen (14) of the 22 reacted (burned, sparked or crackled) with the 
application of a flame to the individual particle. All 14 were determined to contain different 
combinations of oxidizer and fuel. Eight (8) of the selected particles did not thermally react to the 
applied flame. These 8 particles did not contain any oxidizer and were determined to contain non- 
energetic/inert chemical species. The presence of inert materials within the enclosed powders 
would necessarily decrease the explosive potential of the powders. 

The composition of the powders from devices 2, 3, 6, 7, 8, 9, 10, 11, 12, 14 and 15 are similar to 
that from device 13. It would not be unreasonable to hypothesize that a representative subsample 
from these would be found to be similarly non-energetic. However, any hypotheses regarding the 
energetic nature of these mixtures requires testing of a representative sample from each. 

The compositions of the powders from devices 1, 4, 5 and 16 contain charcoal or aluminum as 
an additional fuel, rendering energetic comparisons to the powder from device 13 tentative. The 
presence of charcoal and aluminum in the two firework products recovered from Sayoc’s van 
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eliminates these products as sources for the powders in devices 2, 3, 6, 7, 8, 9, 10, 11, 12, 13, 
14 or 15. 

The Scientific Method as described in NFPA 921, Guide for Fire and Explosions, 2017 Edition, 
Chapter 4, (see Appendix 1) describes the fundamental methodology for developing and testing 
hypotheses. This chapter also defines the types of bias that can influence decision making and 
conclusions in forensic investigations and how to avoid and prevent such sources or error. All 
hypotheses of energetic potential for the powders in the recovered devices requires additional 
testing as per NFPA 921. 

The powders in the small envelopes (labeled “MIXED”) were determined to be non-energetic and 
inert. The analysis for microbiological toxins demonstrated the concern for the presence of 
biological toxins by investigators. There have been numerous events chronicled in the press over 
recent years of toxic white powders discovered in mailed items. The powders in the sixteen 
mailings were likely facsimile powders. 

Conclusions 

The following conclusions are based on the analysis to date, as well as on prior education, 
training, testing, engineering analysis, and experience. ESI reserves the right to supplement or 
amend these findings and conclusions if additional information becomes available or based upon 
additional work or analysis in this matter. These conclusions are all stated to a more probable 
than not basis. 

1. The field test conducted on the powder from device 13 was negative and the powder was 
concluded to be non-energetic. 

2. The powder in device 13 had a similar composition to the powders from eleven of the other 
devices. 

3. The powders recovered from fifteen of the sixteen mailed devices were not tested 
sufficiently to determine if any of the intact powders was an explosive/energetic mixture. 

4. Testing conducted in the FBI laboratory was not sufficient to conclude that intact powders 
from any of the devices were or were not energetic. 

5. The Scientific Method, as outlined in NFPA 921, Guide for Fire and Explosion 
Investigations, Edition 17, was not followed in testing the hypotheses that the powders 
were energetic. 

6. None of the devices’ initiation mechanisms were connected to a battery. 

7. No ignition source was present in any of the devices. 

8. None of the device containers were fabricated to be a gas-tight enclosure. 

9. None of the sixteen mailed devices were functional; as fabricated, none could function as 
a destructive device. 

10. As designed and assembled, the 16 devices are, at best, each a crude counterfeit of an 
explosive device. 
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11. The powders present in the small envelopes were not energetic or microbiologically toxic. 

12. The entire contents of each mailing envelope were crude counterfeits of devices 
historically considered to be potentially harmful or toxic. 

13. The FBI had the opportunity to test the intact powders for reactivity and explosive potential 
and chose not to do so. 

14. The description of the disassembled remains of the sixteen (16) devices as “Improvised 
Explosive Devices (lEDs)" in the FBI report dated January 2, 2019 is incorrect and 
inappropriate. 

15. The sixteen (16) devices are not “destructive devices" as defined in Title 18 United States 
Code, Section 921. 

16. The powder remaining from each device can be further tested to determine if the powder 
mixtures are energetic. 


»End of Report« 

Attachment 1 - NPFA 921 Guide for Fire and Explosion Investigations, 2017 - Chapter 4 
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